Merge pull request #3186 from rust-lang/pa-sha1

pietroalbini · web-flow · commit ac2594fc21f4 · 2023-02-01T16:41:54.000+01:00
Accept SHA1 keys and release 1.25.2
diff --git a/.github/workflows/centos-fmt-clippy-on-all.yaml b/.github/workflows/centos-fmt-clippy-on-all.yaml
@@ -82,9 +82,9 @@ jobs:
             sh ./ci/raw_init.sh
       - name: Run shell checks
         run: |
-          shellcheck -s dash -- rustup-init.sh
-          git ls-files -- '*.sh' | xargs shellcheck -s dash -e SC1090
-          git ls-files -- '*.bash' | xargs shellcheck -s bash -e SC1090
+          shellcheck -x -s dash -- rustup-init.sh
+          git ls-files -- '*.sh' | xargs shellcheck -x -s dash
+          git ls-files -- '*.bash' | xargs shellcheck -x -s bash
       - name: Run formatting checks
         run: |
           cargo fmt --all --check
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Changelog
 
+## [1.25.2] - 2023-02-01
+
+This version of Rustup changes the signature verification code to continue
+accepting Rust's release signature key, which previously caused warnings due to
+a time-based check.
+
+Note that signature verification in Rustup is still an experimental feature,
+and there is intentionally no way to enforce signature verification due to the
+feature being incomplete.
+
+Thanks go to:
+
+- Pietro Albini
+- Daniel Silverstone
+
+[1.25.2]: https://github.com/rust-lang/rustup/release/tag/1.25.2
+
 ## [1.25.1] - 2022-07-12
 
 This version of Rustup reverts a single PR from 1.25.1 and tidies a couple of internal
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -9,7 +9,7 @@ license = "MIT OR Apache-2.0"
 name = "rustup"
 readme = "README.md"
 repository = "https://github.com/rust-lang/rustup"
-version = "1.25.1"
+version = "1.25.2"
 
 [features]
 curl-backend = ["download/curl-backend"]
diff --git a/ci/actions-templates/centos-fmt-clippy-template.yaml b/ci/actions-templates/centos-fmt-clippy-template.yaml
@@ -82,9 +82,9 @@ jobs:
             sh ./ci/raw_init.sh
       - name: Run shell checks
         run: |
-          shellcheck -s dash -- rustup-init.sh
-          git ls-files -- '*.sh' | xargs shellcheck -s dash -e SC1090
-          git ls-files -- '*.bash' | xargs shellcheck -s bash -e SC1090
+          shellcheck -x -s dash -- rustup-init.sh
+          git ls-files -- '*.sh' | xargs shellcheck -x -s dash
+          git ls-files -- '*.bash' | xargs shellcheck -x -s bash
       - name: Run formatting checks
         run: |
           cargo fmt --all --check
diff --git a/ci/cirrus-templates/script.bash b/ci/cirrus-templates/script.bash
@@ -1,4 +1,4 @@
-#!/bin/bash                                                                                            
+#!/bin/bash
 
 set -ex
 
@@ -26,6 +26,7 @@ echo "Install Rustup using ./rustup-init.sh"
 
 sh rustup-init.sh --default-toolchain=stable --profile=minimal -y
 # It's the equivalent of `source`
+# shellcheck source=src/cli/self_update/env.sh
 source "$HOME"/.cargo/env
 
 echo "========="
diff --git a/ci/fetch-rust-docker.bash b/ci/fetch-rust-docker.bash
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 script_dir=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=ci/shared.bash
 . "$script_dir/shared.bash"
 
 set -e
@@ -39,6 +40,11 @@ case "$TARGET" in
 esac
 
 master=$(git ls-remote "$RUST_REPO" refs/heads/master | cut -f1)
+# FIXME: bad hack to get a good working image for the 2023-02-01 release, this
+# will get broken for future releases
+if [[ "${image}" = "dist-android" ]]; then
+    master="6d46b1ec8769fbbb3ac2a2cb12f0cad527135413"
+fi
 image_url="$ARTIFACTS_BASE_URL/$master/image-$image.txt"
 info="/tmp/image-$image.txt"
 
diff --git a/ci/raw_init.sh b/ci/raw_init.sh
@@ -3,5 +3,6 @@
 set -ex
 
 sh ./rustup-init.sh --default-toolchain none -y
+# shellcheck source=src/cli/self_update/env.sh
 . "$HOME"/.cargo/env
 rustup -Vv
diff --git a/download/Cargo.toml b/download/Cargo.toml
@@ -4,7 +4,7 @@ authors = ["Brian Anderson <banderson@mozilla.com>"]
 edition = "2021"
 license = "MIT OR Apache-2.0"
 name = "download"
-version = "1.25.1"
+version = "1.25.2"
 
 [features]
 
diff --git a/rustup-init.sh b/rustup-init.sh
@@ -25,7 +25,7 @@ RUSTUP_UPDATE_ROOT="${RUSTUP_UPDATE_ROOT:-https://static.rust-lang.org/rustup}"
 #XXX: If you change anything here, please make the same changes in setup_mode.rs
 usage() {
     cat 1>&2 <<EOF
-rustup-init 1.25.1 (48d233f65 2022-07-12)
+rustup-init 1.25.2 (8c4dad73d 2023-02-01)
 The installer for rustup
 
 USAGE:
@@ -590,7 +590,7 @@ check_help_for() {
     esac
 
     for _arg in "$@"; do
-        if ! "$_cmd" --help $_category | grep -q -- "$_arg"; then
+        if ! "$_cmd" --help "$_category" | grep -q -- "$_arg"; then
             return 1
         fi
     done
diff --git a/src/config.rs b/src/config.rs
@@ -7,12 +7,13 @@ use std::str::FromStr;
 use std::sync::Arc;
 
 use anyhow::{anyhow, bail, Context, Result};
-use sequoia_openpgp::{parse::Parse, policy, Cert};
+use sequoia_openpgp::{parse::Parse, Cert};
 use serde::Deserialize;
 use thiserror::Error as ThisError;
 
 use crate::cli::self_update::SelfUpdateMode;
 use crate::dist::download::DownloadCfg;
+use crate::dist::signatures::sequoia_policy;
 use crate::dist::{
     dist::{self, Profile},
     temp,
@@ -198,7 +199,8 @@ impl PgpPublicKey {
         let keyid = format_hex(cert.keyid().as_bytes(), "-", 4)?;
         let algo = cert.primary_key().pk_algo();
         let fpr = format_hex(cert.fingerprint().as_bytes(), " ", 2)?;
-        let p = policy::StandardPolicy::new();
+        let p = sequoia_policy();
+
         let uid0 = cert
             .with_policy(&p, None)?
             .primary_userid()
diff --git a/src/dist/signatures.rs b/src/dist/signatures.rs
@@ -8,11 +8,32 @@ use anyhow::Result;
 
 use sequoia_openpgp::{
     parse::{stream::*, Parse},
-    policy, Cert, KeyHandle,
+    policy::{HashAlgoSecurity, StandardPolicy},
+    types::HashAlgorithm,
+    Cert, KeyHandle,
 };
 
 use crate::config::PgpPublicKey;
 
+pub(crate) fn sequoia_policy() -> StandardPolicy<'static> {
+    let mut policy = StandardPolicy::new();
+
+    // The builtin Rust signature key uses SHA-1 for its own signature, even though the individual
+    // signatures generated by it nowadays use SHA-512. Sequoia added a cutoff date for SHA1,
+    // 2023-02-01, which caused warnings to be displayed to rustup users from that day onwards.
+    //
+    // To keep supporting the Rust signature key, we allow the SHA-1 algorithm in rustup without a
+    // cutoff date when verifying the signature key bindings. SHA-1 data signatures are still
+    // disallowed.
+    policy.reject_hash_property_at(
+        HashAlgorithm::SHA1,
+        HashAlgoSecurity::SecondPreImageResistance,
+        None,
+    );
+
+    policy
+}
+
 /// Returns the index of the cert in `certs` that verifies a
 /// signature.
 ///
@@ -26,7 +47,8 @@ pub(crate) fn verify_signature<T: Read + Send + Sync>(
     signature: &str,
     certs: &[PgpPublicKey],
 ) -> Result<Option<usize>> {
-    let p = policy::StandardPolicy::new();
+    let p = sequoia_policy();
+
     let helper = Helper::new(certs);
     let mut v = DetachedVerifierBuilder::from_reader(signature.as_bytes())?
         .with_policy(&p, None, helper)?;
